feat(bec): add full BEC case workflow - #490
Draft
Zacgoose wants to merge 3 commits into
Draft
Conversation
Zacgoose
force-pushed
the
preview/bec-case-workflow
branch
5 times, most recently
from
September 4, 2026 14:02
2628cd4 to
b3f5d2b
Compare
Replace the old single-user BEC check/remediate flow with a full case-based investigation system. This adds new backend collectors, heuristics/scoring, report storage, containment orchestration, evidence export, Purview content-search actions, bulk queueing, and progress tracking; updates alert automation and logging context; and introduces new user/report pages and components for run history, containment, phishing spread, evidence export, and BEC reports. Documentation and broad backend/frontend tests were added to cover the new behavior.
…olete 50-user cap test The committed openapi.json carried ExecBECContentSearch's StartDate/EndDate in format-first key order, which no longer matches the deterministic ([ordered]) generator - a full rebuild produces type-first and CI -Check would report drift. Regenerate so the two date-time leaves are type-first. ExecBECBulkCheck no longer caps the user count, but the endpoint test still asserted a 50-user refusal. Replace that assertion with a positive check that a list over 50 is accepted and every resolvable user is queued, and keep the empty-selection guard.
Zacgoose
force-pushed
the
preview/bec-case-workflow
branch
from
September 4, 2026 14:51
b3f5d2b to
dfc270a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the old single-user BEC check/remediate flow with a full case-based investigation system. This adds new backend collectors, heuristics/scoring, report storage, containment orchestration, evidence export, Purview content-search actions, bulk queueing, and progress tracking; updates alert automation and logging context; and introduces new user/report pages and components for run history, containment, phishing spread, evidence export, and BEC reports. Documentation and broad backend/frontend tests were added to cover the new behavior.